From 87362be154b8bf92de9dac5ef959a32e68dbea66 Mon Sep 17 00:00:00 2001
From: mike12345567 <me@michaeldrury.co.uk>
Date: Wed, 20 Sep 2023 10:51:21 +0100
Subject: [PATCH 01/15] Removing required from roles on user API, as it is now
 paid.

---
 packages/server/specs/openapi.json         | 5 +----
 packages/server/specs/openapi.yaml         | 3 ---
 packages/server/specs/resources/user.ts    | 2 +-
 packages/server/src/definitions/openapi.ts | 6 +++---
 specs/openapi.json                         | 1 -
 specs/openapi.yaml                         | 1 -
 6 files changed, 5 insertions(+), 13 deletions(-)
 delete mode 120000 specs/openapi.json
 delete mode 120000 specs/openapi.yaml

diff --git a/packages/server/specs/openapi.json b/packages/server/specs/openapi.json
index 1e5718c5b5..5301d340bc 100644
--- a/packages/server/specs/openapi.json
+++ b/packages/server/specs/openapi.json
@@ -1550,8 +1550,7 @@
           }
         },
         "required": [
-          "email",
-          "roles"
+          "email"
         ]
       },
       "userOutput": {
@@ -1622,7 +1621,6 @@
             },
             "required": [
               "email",
-              "roles",
               "_id"
             ]
           }
@@ -1701,7 +1699,6 @@
               },
               "required": [
                 "email",
-                "roles",
                 "_id"
               ]
             }
diff --git a/packages/server/specs/openapi.yaml b/packages/server/specs/openapi.yaml
index 07320917b8..a525ec3be1 100644
--- a/packages/server/specs/openapi.yaml
+++ b/packages/server/specs/openapi.yaml
@@ -1324,7 +1324,6 @@ components:
               role ID, e.g. ADMIN.
       required:
         - email
-        - roles
     userOutput:
       type: object
       properties:
@@ -1385,7 +1384,6 @@ components:
               type: string
           required:
             - email
-            - roles
             - _id
       required:
         - data
@@ -1451,7 +1449,6 @@ components:
                 type: string
             required:
               - email
-              - roles
               - _id
       required:
         - data
diff --git a/packages/server/specs/resources/user.ts b/packages/server/specs/resources/user.ts
index d00ed02f81..caf736f1ab 100644
--- a/packages/server/specs/resources/user.ts
+++ b/packages/server/specs/resources/user.ts
@@ -92,7 +92,7 @@ const userSchema = object(
       },
     },
   },
-  { required: ["email", "roles"] }
+  { required: ["email"] }
 )
 
 const userOutputSchema = {
diff --git a/packages/server/src/definitions/openapi.ts b/packages/server/src/definitions/openapi.ts
index fe5c17b218..5c44b6259f 100644
--- a/packages/server/src/definitions/openapi.ts
+++ b/packages/server/src/definitions/openapi.ts
@@ -599,7 +599,7 @@ export interface components {
         global?: boolean;
       };
       /** @description Contains the roles of the user per app (assuming they are not a builder user). This field can only be set on a business or enterprise license. */
-      roles: { [key: string]: string };
+      roles?: { [key: string]: string };
     };
     userOutput: {
       data: {
@@ -629,7 +629,7 @@ export interface components {
           global?: boolean;
         };
         /** @description Contains the roles of the user per app (assuming they are not a builder user). This field can only be set on a business or enterprise license. */
-        roles: { [key: string]: string };
+        roles?: { [key: string]: string };
         /** @description The ID of the user. */
         _id: string;
       };
@@ -662,7 +662,7 @@ export interface components {
           global?: boolean;
         };
         /** @description Contains the roles of the user per app (assuming they are not a builder user). This field can only be set on a business or enterprise license. */
-        roles: { [key: string]: string };
+        roles?: { [key: string]: string };
         /** @description The ID of the user. */
         _id: string;
       }[];
diff --git a/specs/openapi.json b/specs/openapi.json
deleted file mode 120000
index 6e1531e3f4..0000000000
--- a/specs/openapi.json
+++ /dev/null
@@ -1 +0,0 @@
-../packages/server/specs/openapi.json
\ No newline at end of file
diff --git a/specs/openapi.yaml b/specs/openapi.yaml
deleted file mode 120000
index 67db6af71f..0000000000
--- a/specs/openapi.yaml
+++ /dev/null
@@ -1 +0,0 @@
-../packages/server/specs/openapi.yaml
\ No newline at end of file

From 65d96b5ec5405c836af9a3d958d0fbab978c690c Mon Sep 17 00:00:00 2001
From: mike12345567 <me@michaeldrury.co.uk>
Date: Wed, 20 Sep 2023 12:13:10 +0100
Subject: [PATCH 02/15] Adding message to let user know why roles have been
 ignored, as well as adding test case for this.

---
 .../api/controllers/public/mapping/users.ts   |  9 +++--
 .../src/api/controllers/public/users.ts       | 34 +++++++++++++++----
 .../src/api/routes/public/tests/users.spec.ts |  6 ++++
 packages/server/src/utilities/users.ts        |  3 ++
 4 files changed, 44 insertions(+), 8 deletions(-)

diff --git a/packages/server/src/api/controllers/public/mapping/users.ts b/packages/server/src/api/controllers/public/mapping/users.ts
index db08b16552..2a158bede9 100644
--- a/packages/server/src/api/controllers/public/mapping/users.ts
+++ b/packages/server/src/api/controllers/public/mapping/users.ts
@@ -15,10 +15,15 @@ function user(body: any): User {
   }
 }
 
-function mapUser(ctx: any): { data: User } {
-  return {
+function mapUser(ctx: any) {
+  const body: { data: User; message?: string } = {
     data: user(ctx.body),
   }
+  if (ctx.extra?.message) {
+    body.message = ctx.extra.message
+    delete ctx.extra
+  }
+  return body
 }
 
 function mapUsers(ctx: any): { data: User[] } {
diff --git a/packages/server/src/api/controllers/public/users.ts b/packages/server/src/api/controllers/public/users.ts
index bb6fc3a6e7..4265c7ac22 100644
--- a/packages/server/src/api/controllers/public/users.ts
+++ b/packages/server/src/api/controllers/public/users.ts
@@ -10,6 +10,32 @@ import { search as stringSearch } from "./utils"
 import { UserCtx, User } from "@budibase/types"
 import { Next } from "koa"
 import { sdk } from "@budibase/pro"
+import { isEqual, cloneDeep } from "lodash"
+
+function rolesRemoved(base: User, ctx: UserCtx) {
+  return (
+    !isEqual(base.builder, ctx.request.body.builder) ||
+    !isEqual(base.admin, ctx.request.body.admin) ||
+    !isEqual(base.roles, ctx.request.body.roles)
+  )
+}
+
+const NO_ROLES_MSG =
+  "Roles/admin/builder can only be set on business/enterprise licenses - input ignored."
+
+async function createUpdateResponse(ctx: UserCtx, user?: User) {
+  const base = cloneDeep(ctx.request.body)
+  ctx = await sdk.publicApi.users.roleCheck(ctx, user)
+  // check the ctx before any updates to it
+  const removed = rolesRemoved(base, ctx)
+  ctx = publicApiUserFix(ctx)
+  const response = await saveGlobalUser(ctx)
+  ctx.body = await getUser(ctx, response._id)
+  if (removed) {
+    ctx.extra = { message: NO_ROLES_MSG }
+  }
+  return ctx
+}
 
 function isLoggedInUser(ctx: UserCtx, user: User) {
   const loggedInId = ctx.user?._id
@@ -35,9 +61,7 @@ export async function search(ctx: UserCtx, next: Next) {
 }
 
 export async function create(ctx: UserCtx, next: Next) {
-  ctx = publicApiUserFix(await sdk.publicApi.users.roleCheck(ctx))
-  const response = await saveGlobalUser(ctx)
-  ctx.body = await getUser(ctx, response._id)
+  await createUpdateResponse(ctx)
   await next()
 }
 
@@ -52,9 +76,7 @@ export async function update(ctx: UserCtx, next: Next) {
     ...ctx.request.body,
     _rev: user._rev,
   }
-  ctx = publicApiUserFix(await sdk.publicApi.users.roleCheck(ctx, user))
-  const response = await saveGlobalUser(ctx)
-  ctx.body = await getUser(ctx, response._id)
+  await createUpdateResponse(ctx, user)
   await next()
 }
 
diff --git a/packages/server/src/api/routes/public/tests/users.spec.ts b/packages/server/src/api/routes/public/tests/users.spec.ts
index c81acca1df..7856409bec 100644
--- a/packages/server/src/api/routes/public/tests/users.spec.ts
+++ b/packages/server/src/api/routes/public/tests/users.spec.ts
@@ -68,6 +68,7 @@ describe("no user role update in free", () => {
     })
     expect(res.status).toBe(200)
     expect(res.body.data.roles["app_a"]).toBeUndefined()
+    expect(res.body.message).toBeDefined()
   })
 
   it("should not allow 'admin' to be updated", async () => {
@@ -77,6 +78,7 @@ describe("no user role update in free", () => {
     })
     expect(res.status).toBe(200)
     expect(res.body.data.admin).toBeUndefined()
+    expect(res.body.message).toBeDefined()
   })
 
   it("should not allow 'builder' to be updated", async () => {
@@ -86,6 +88,7 @@ describe("no user role update in free", () => {
     })
     expect(res.status).toBe(200)
     expect(res.body.data.builder).toBeUndefined()
+    expect(res.body.message).toBeDefined()
   })
 })
 
@@ -102,6 +105,7 @@ describe("no user role update in business", () => {
     })
     expect(res.status).toBe(200)
     expect(res.body.data.roles["app_a"]).toBe("BASIC")
+    expect(res.body.message).toBeUndefined()
   })
 
   it("should allow 'admin' to be updated", async () => {
@@ -112,6 +116,7 @@ describe("no user role update in business", () => {
     })
     expect(res.status).toBe(200)
     expect(res.body.data.admin.global).toBe(true)
+    expect(res.body.message).toBeUndefined()
   })
 
   it("should allow 'builder' to be updated", async () => {
@@ -122,5 +127,6 @@ describe("no user role update in business", () => {
     })
     expect(res.status).toBe(200)
     expect(res.body.data.builder.global).toBe(true)
+    expect(res.body.message).toBeUndefined()
   })
 })
diff --git a/packages/server/src/utilities/users.ts b/packages/server/src/utilities/users.ts
index f841ec3646..bbc1370355 100644
--- a/packages/server/src/utilities/users.ts
+++ b/packages/server/src/utilities/users.ts
@@ -36,5 +36,8 @@ export function publicApiUserFix(ctx: UserCtx) {
   if (!ctx.request.body._id && ctx.params.userId) {
     ctx.request.body._id = ctx.params.userId
   }
+  if (!ctx.request.body.roles) {
+    ctx.request.body.roles = {}
+  }
   return ctx
 }

From 7db7159b4cdcf76710278d7c30eaec4f11309e2d Mon Sep 17 00:00:00 2001
From: Budibase Staging Release Bot <>
Date: Wed, 20 Sep 2023 11:54:52 +0000
Subject: [PATCH 03/15] Bump version to 2.10.12

---
 lerna.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lerna.json b/lerna.json
index fbecff9293..19298d35ec 100644
--- a/lerna.json
+++ b/lerna.json
@@ -1,5 +1,5 @@
 {
-  "version": "2.10.11",
+  "version": "2.10.12",
   "npmClient": "yarn",
   "packages": [
     "packages/*"

From 69c688a03ee7b551db31ca1b60e7d9aee1e3cd01 Mon Sep 17 00:00:00 2001
From: Andrew Kingston <andrew@kingston.dev>
Date: Fri, 22 Sep 2023 08:48:34 +0100
Subject: [PATCH 04/15] Update section component grid column styles to explicit
 widths to prevent issues with dynamic resizing and overflow

---
 .../client/src/components/app/Section.svelte  | 27 ++++++++++---------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/packages/client/src/components/app/Section.svelte b/packages/client/src/components/app/Section.svelte
index 11f0f2978f..b86c5cc352 100644
--- a/packages/client/src/components/app/Section.svelte
+++ b/packages/client/src/components/app/Section.svelte
@@ -47,28 +47,29 @@
 <style>
   div {
     display: grid;
-    grid-gap: 16px;
+    --gap: 16px;
+    grid-gap: var(--gap);
   }
   .mainSidebar {
-    grid-template-columns: 3fr 1fr;
+    grid-template-columns:
+      calc((100% - var(--gap)) / 4 * 3) /* 75% */
+      calc((100% - var(--gap)) / 4); /* 25% */
   }
   .sidebarMain {
-    grid-template-columns: 1fr 3fr;
-  }
-  .oneColumn {
-    grid-template-columns: 1fr;
-  }
-  .twoColumns {
-    grid-template-columns: 1fr 1fr;
-  }
-  .threeColumns {
-    grid-template-columns: 1fr 1fr 1fr;
+    grid-template-columns:
+      calc((100% - var(--gap)) / 4) /* 25% */
+      calc((100% - var(--gap)) / 4 * 3); /* 75% */
   }
+  .oneColumn,
   .columns-1 {
     grid-template-columns: 1fr;
   }
+  .twoColumns,
   .columns-2 {
-    grid-template-columns: 1fr 1fr;
+    grid-template-columns: repeat(2, calc((100% - var(--gap)) / 2));
+  }
+  .threeColumns {
+    grid-template-columns: repeat(3, calc((100% - var(--gap)) / 3));
   }
   .placeholder {
     border: 2px dashed var(--spectrum-global-color-gray-600);

From b979b29313ab396940338e572334a5a0e411e59f Mon Sep 17 00:00:00 2001
From: Martin McKeaveney <martinmckeaveney@gmail.com>
Date: Sat, 23 Sep 2023 00:10:12 +0100
Subject: [PATCH 05/15] e2e secure microsoft auth

---
 packages/backend-core/src/db/views.ts         |  4 +++
 packages/backend-core/src/platform/users.ts   | 28 ++++++++++++++++---
 packages/backend-core/src/users/db.ts         |  2 +-
 packages/types/src/api/account/accounts.ts    |  4 ++-
 .../types/src/documents/account/account.ts    |  7 +++++
 packages/types/src/documents/global/user.ts   |  1 +
 .../types/src/documents/platform/users.ts     | 11 +++++++-
 .../src/api/controllers/global/users.ts       |  5 +++-
 .../worker/src/api/routes/global/users.ts     |  1 +
 9 files changed, 55 insertions(+), 8 deletions(-)

diff --git a/packages/backend-core/src/db/views.ts b/packages/backend-core/src/db/views.ts
index 7f5ef29a0a..f0980ad217 100644
--- a/packages/backend-core/src/db/views.ts
+++ b/packages/backend-core/src/db/views.ts
@@ -190,6 +190,10 @@ export const createPlatformUserView = async () => {
     if (doc.tenantId) {
       emit(doc._id.toLowerCase(), doc._id)
     }
+
+    if (doc.ssoId) {
+      emit(doc.ssoId, doc._id)
+    }
   }`
   await createPlatformView(viewJs, ViewName.PLATFORM_USERS_LOWERCASE)
 }
diff --git a/packages/backend-core/src/platform/users.ts b/packages/backend-core/src/platform/users.ts
index c65a7e0ec4..684dd40052 100644
--- a/packages/backend-core/src/platform/users.ts
+++ b/packages/backend-core/src/platform/users.ts
@@ -4,7 +4,7 @@ import env from "../environment"
 import {
   PlatformUser,
   PlatformUserByEmail,
-  PlatformUserById,
+  PlatformUserById, PlatformUserBySsoId,
   User,
 } from "@budibase/types"
 
@@ -45,6 +45,20 @@ function newUserEmailDoc(
   }
 }
 
+function newUserSsoIdDoc(
+  ssoId: string,
+  email: string,
+  userId: string,
+  tenantId: string,
+): PlatformUserBySsoId {
+  return {
+    _id: ssoId,
+    userId,
+    email,
+    tenantId,
+  }
+}
+
 /**
  * Add a new user id or email doc if it doesn't exist.
  */
@@ -64,11 +78,17 @@ async function addUserDoc(emailOrId: string, newDocFn: () => PlatformUser) {
   }
 }
 
-export async function addUser(tenantId: string, userId: string, email: string) {
-  await Promise.all([
+export async function addUser(tenantId: string, userId: string, email: string, ssoId?: string) {
+  const promises = [
     addUserDoc(userId, () => newUserIdDoc(userId, tenantId)),
     addUserDoc(email, () => newUserEmailDoc(userId, email, tenantId)),
-  ])
+  ]
+
+  if (ssoId) {
+    promises.push(addUserDoc(ssoId, () => newUserSsoIdDoc(ssoId, email, userId, tenantId)))
+  }
+
+  await Promise.all(promises)
 }
 
 // DELETE
diff --git a/packages/backend-core/src/users/db.ts b/packages/backend-core/src/users/db.ts
index c288540f35..b39fbb5d61 100644
--- a/packages/backend-core/src/users/db.ts
+++ b/packages/backend-core/src/users/db.ts
@@ -278,7 +278,7 @@ export class UserDB {
         builtUser._rev = response.rev
 
         await eventHelpers.handleSaveEvents(builtUser, dbUser)
-        await platform.users.addUser(tenantId, builtUser._id!, builtUser.email)
+        await platform.users.addUser(tenantId, builtUser._id!, builtUser.email, builtUser.ssoId)
         await cache.user.invalidateUser(response.id)
 
         await Promise.all(groupPromises)
diff --git a/packages/types/src/api/account/accounts.ts b/packages/types/src/api/account/accounts.ts
index bb3419c5d1..1be506e14e 100644
--- a/packages/types/src/api/account/accounts.ts
+++ b/packages/types/src/api/account/accounts.ts
@@ -1,4 +1,4 @@
-import { Account } from "../../documents"
+import { Account, AccountSSOProvider } from "../../documents"
 import { Hosting } from "../../sdk"
 
 export interface CreateAccountRequest {
@@ -11,6 +11,8 @@ export interface CreateAccountRequest {
   tenantName?: string
   name?: string
   password: string
+  provider?: AccountSSOProvider
+  thirdPartyProfile: object
 }
 
 export interface SearchAccountsRequest {
diff --git a/packages/types/src/documents/account/account.ts b/packages/types/src/documents/account/account.ts
index 5321aa7e08..c22ed3572b 100644
--- a/packages/types/src/documents/account/account.ts
+++ b/packages/types/src/documents/account/account.ts
@@ -20,6 +20,11 @@ export interface CreatePassswordAccount extends CreateAccount {
   password: string
 }
 
+export interface CreateVerifiableSSOAccount extends CreateAccount {
+  provider?: AccountSSOProvider
+  thirdPartyProfile?: any
+}
+
 export const isCreatePasswordAccount = (
   account: CreateAccount
 ): account is CreatePassswordAccount => account.authType === AuthType.PASSWORD
@@ -50,6 +55,8 @@ export interface Account extends CreateAccount {
   licenseKeyActivatedAt?: number
   licenseRequestedAt?: number
   licenseOverrides?: LicenseOverrides
+  provider?: AccountSSOProvider
+  providerType?: AccountSSOProviderType
   quotaUsage?: QuotaUsage
   offlineLicenseToken?: string
 }
diff --git a/packages/types/src/documents/global/user.ts b/packages/types/src/documents/global/user.ts
index 2ce714801d..9769661cd5 100644
--- a/packages/types/src/documents/global/user.ts
+++ b/packages/types/src/documents/global/user.ts
@@ -55,6 +55,7 @@ export interface User extends Document {
   userGroups?: string[]
   onboardedAt?: string
   scimInfo?: { isSync: true } & Record<string, any>
+  ssoId?: string
 }
 
 export enum UserStatus {
diff --git a/packages/types/src/documents/platform/users.ts b/packages/types/src/documents/platform/users.ts
index 46cc44b31d..42754b5e5a 100644
--- a/packages/types/src/documents/platform/users.ts
+++ b/packages/types/src/documents/platform/users.ts
@@ -15,4 +15,13 @@ export interface PlatformUserById extends Document {
   tenantId: string
 }
 
-export type PlatformUser = PlatformUserByEmail | PlatformUserById
+/**
+ * doc id is a unique SSO provider ID for the user
+ */
+export interface PlatformUserBySsoId extends Document {
+  tenantId: string
+  userId: string
+  email: string
+}
+
+export type PlatformUser = PlatformUserByEmail | PlatformUserById | PlatformUserBySsoId
diff --git a/packages/worker/src/api/controllers/global/users.ts b/packages/worker/src/api/controllers/global/users.ts
index 6d3a13aa4e..8968ebdcd0 100644
--- a/packages/worker/src/api/controllers/global/users.ts
+++ b/packages/worker/src/api/controllers/global/users.ts
@@ -95,7 +95,8 @@ const parseBooleanParam = (param: any) => {
 export const adminUser = async (
   ctx: Ctx<CreateAdminUserRequest, CreateAdminUserResponse>
 ) => {
-  const { email, password, tenantId } = ctx.request.body
+  // @ts-ignore
+  const { email, password, tenantId, ssoId } = ctx.request.body
 
   if (await platform.tenants.exists(tenantId)) {
     ctx.throw(403, "Organisation already exists.")
@@ -136,6 +137,8 @@ export const adminUser = async (
         global: true,
       },
       tenantId,
+      // @ts-ignore
+      ssoId,
     }
     try {
       // always bust checklist beforehand, if an error occurs but can proceed, don't get
diff --git a/packages/worker/src/api/routes/global/users.ts b/packages/worker/src/api/routes/global/users.ts
index 47e76c17be..a57f7834ac 100644
--- a/packages/worker/src/api/routes/global/users.ts
+++ b/packages/worker/src/api/routes/global/users.ts
@@ -14,6 +14,7 @@ function buildAdminInitValidation() {
       email: Joi.string().required(),
       password: Joi.string(),
       tenantId: Joi.string().required(),
+      ssoId: Joi.string(),
     })
       .required()
       .unknown(false)

From 9cf41133fbff0e644e81b9f5867dcc58d0274f48 Mon Sep 17 00:00:00 2001
From: Martin McKeaveney <martinmckeaveney@gmail.com>
Date: Sun, 24 Sep 2023 19:40:37 +0100
Subject: [PATCH 06/15] add verifiable SSO providers type

---
 packages/types/src/documents/account/account.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/packages/types/src/documents/account/account.ts b/packages/types/src/documents/account/account.ts
index c22ed3572b..764b32a82d 100644
--- a/packages/types/src/documents/account/account.ts
+++ b/packages/types/src/documents/account/account.ts
@@ -94,6 +94,10 @@ export enum AccountSSOProvider {
   MICROSOFT = "microsoft",
 }
 
+export enum VerifiableSSOProviders {
+  MICROSOFT = "microsoft"
+}
+
 export interface AccountSSO {
   provider: AccountSSOProvider
   providerType: AccountSSOProviderType

From ba52a901a941c60d1f184dbc0c4bde4bbb330f28 Mon Sep 17 00:00:00 2001
From: Martin McKeaveney <martinmckeaveney@gmail.com>
Date: Sun, 24 Sep 2023 20:47:29 +0100
Subject: [PATCH 07/15] improved type guards

---
 packages/types/src/documents/account/account.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/types/src/documents/account/account.ts b/packages/types/src/documents/account/account.ts
index 764b32a82d..035f95c4f2 100644
--- a/packages/types/src/documents/account/account.ts
+++ b/packages/types/src/documents/account/account.ts
@@ -94,8 +94,9 @@ export enum AccountSSOProvider {
   MICROSOFT = "microsoft",
 }
 
-export enum VerifiableSSOProviders {
-  MICROSOFT = "microsoft"
+const verifiableSSOProviders: AccountSSOProvider[] = [AccountSSOProvider.MICROSOFT]
+export function isVerifiableSSOProvider(provider: AccountSSOProvider): boolean {
+  return verifiableSSOProviders.includes(provider);
 }
 
 export interface AccountSSO {

From 6d4e3082e355d0853f2deaf6b1487e92f1125358 Mon Sep 17 00:00:00 2001
From: Martin McKeaveney <martinmckeaveney@gmail.com>
Date: Sun, 24 Sep 2023 22:07:40 +0100
Subject: [PATCH 08/15] type tidy up and lint

---
 packages/backend-core/src/platform/users.ts   | 16 ++++++--
 packages/backend-core/src/users/db.ts         |  7 +++-
 .../core/utilities/structures/accounts.ts     | 37 +++++++++++++++++--
 packages/types/src/api/web/user.ts            |  1 +
 .../types/src/documents/account/account.ts    |  6 ++-
 .../types/src/documents/platform/users.ts     |  5 ++-
 .../src/api/controllers/global/users.ts       |  2 -
 7 files changed, 61 insertions(+), 13 deletions(-)

diff --git a/packages/backend-core/src/platform/users.ts b/packages/backend-core/src/platform/users.ts
index 684dd40052..6f030afb7c 100644
--- a/packages/backend-core/src/platform/users.ts
+++ b/packages/backend-core/src/platform/users.ts
@@ -4,7 +4,8 @@ import env from "../environment"
 import {
   PlatformUser,
   PlatformUserByEmail,
-  PlatformUserById, PlatformUserBySsoId,
+  PlatformUserById,
+  PlatformUserBySsoId,
   User,
 } from "@budibase/types"
 
@@ -49,7 +50,7 @@ function newUserSsoIdDoc(
   ssoId: string,
   email: string,
   userId: string,
-  tenantId: string,
+  tenantId: string
 ): PlatformUserBySsoId {
   return {
     _id: ssoId,
@@ -78,14 +79,21 @@ async function addUserDoc(emailOrId: string, newDocFn: () => PlatformUser) {
   }
 }
 
-export async function addUser(tenantId: string, userId: string, email: string, ssoId?: string) {
+export async function addUser(
+  tenantId: string,
+  userId: string,
+  email: string,
+  ssoId?: string
+) {
   const promises = [
     addUserDoc(userId, () => newUserIdDoc(userId, tenantId)),
     addUserDoc(email, () => newUserEmailDoc(userId, email, tenantId)),
   ]
 
   if (ssoId) {
-    promises.push(addUserDoc(ssoId, () => newUserSsoIdDoc(ssoId, email, userId, tenantId)))
+    promises.push(
+      addUserDoc(ssoId, () => newUserSsoIdDoc(ssoId, email, userId, tenantId))
+    )
   }
 
   await Promise.all(promises)
diff --git a/packages/backend-core/src/users/db.ts b/packages/backend-core/src/users/db.ts
index b39fbb5d61..1d02bebc32 100644
--- a/packages/backend-core/src/users/db.ts
+++ b/packages/backend-core/src/users/db.ts
@@ -278,7 +278,12 @@ export class UserDB {
         builtUser._rev = response.rev
 
         await eventHelpers.handleSaveEvents(builtUser, dbUser)
-        await platform.users.addUser(tenantId, builtUser._id!, builtUser.email, builtUser.ssoId)
+        await platform.users.addUser(
+          tenantId,
+          builtUser._id!,
+          builtUser.email,
+          builtUser.ssoId
+        )
         await cache.user.invalidateUser(response.id)
 
         await Promise.all(groupPromises)
diff --git a/packages/backend-core/tests/core/utilities/structures/accounts.ts b/packages/backend-core/tests/core/utilities/structures/accounts.ts
index 67e4411ea3..515f94db1e 100644
--- a/packages/backend-core/tests/core/utilities/structures/accounts.ts
+++ b/packages/backend-core/tests/core/utilities/structures/accounts.ts
@@ -1,4 +1,4 @@
-import { generator, uuid, quotas } from "."
+import { generator, quotas, uuid } from "."
 import { generateGlobalUserID } from "../../../../src/docIds"
 import {
   Account,
@@ -6,10 +6,11 @@ import {
   AccountSSOProviderType,
   AuthType,
   CloudAccount,
-  Hosting,
-  SSOAccount,
   CreateAccount,
   CreatePassswordAccount,
+  CreateVerifiableSSOAccount,
+  Hosting,
+  SSOAccount,
 } from "@budibase/types"
 import sample from "lodash/sample"
 
@@ -68,6 +69,23 @@ export function ssoAccount(account: Account = cloudAccount()): SSOAccount {
   }
 }
 
+export function verifiableSsoAccount(
+  account: Account = cloudAccount()
+): SSOAccount {
+  return {
+    ...account,
+    authType: AuthType.SSO,
+    oauth2: {
+      accessToken: generator.string(),
+      refreshToken: generator.string(),
+    },
+    pictureUrl: generator.url(),
+    provider: AccountSSOProvider.MICROSOFT,
+    providerType: AccountSSOProviderType.MICROSOFT,
+    thirdPartyProfile: { id: "abc123" },
+  }
+}
+
 export const cloudCreateAccount: CreatePassswordAccount = {
   email: "cloud@budibase.com",
   tenantId: "cloud",
@@ -91,6 +109,19 @@ export const cloudSSOCreateAccount: CreateAccount = {
   profession: "Software Engineer",
 }
 
+export const cloudVerifiableSSOCreateAccount: CreateVerifiableSSOAccount = {
+  email: "cloud-sso@budibase.com",
+  tenantId: "cloud-sso",
+  hosting: Hosting.CLOUD,
+  authType: AuthType.SSO,
+  tenantName: "cloudsso",
+  name: "Budi Armstrong",
+  size: "10+",
+  profession: "Software Engineer",
+  provider: AccountSSOProvider.MICROSOFT,
+  thirdPartyProfile: { id: "abc123" },
+}
+
 export const selfCreateAccount: CreatePassswordAccount = {
   email: "self@budibase.com",
   tenantId: "self",
diff --git a/packages/types/src/api/web/user.ts b/packages/types/src/api/web/user.ts
index 619362805a..85e2d89ad1 100644
--- a/packages/types/src/api/web/user.ts
+++ b/packages/types/src/api/web/user.ts
@@ -61,6 +61,7 @@ export interface CreateAdminUserRequest {
   email: string
   password: string
   tenantId: string
+  ssoId?: string
 }
 
 export interface CreateAdminUserResponse {
diff --git a/packages/types/src/documents/account/account.ts b/packages/types/src/documents/account/account.ts
index 035f95c4f2..2f74b9e7b3 100644
--- a/packages/types/src/documents/account/account.ts
+++ b/packages/types/src/documents/account/account.ts
@@ -94,9 +94,11 @@ export enum AccountSSOProvider {
   MICROSOFT = "microsoft",
 }
 
-const verifiableSSOProviders: AccountSSOProvider[] = [AccountSSOProvider.MICROSOFT]
+const verifiableSSOProviders: AccountSSOProvider[] = [
+  AccountSSOProvider.MICROSOFT,
+]
 export function isVerifiableSSOProvider(provider: AccountSSOProvider): boolean {
-  return verifiableSSOProviders.includes(provider);
+  return verifiableSSOProviders.includes(provider)
 }
 
 export interface AccountSSO {
diff --git a/packages/types/src/documents/platform/users.ts b/packages/types/src/documents/platform/users.ts
index 42754b5e5a..8f24329502 100644
--- a/packages/types/src/documents/platform/users.ts
+++ b/packages/types/src/documents/platform/users.ts
@@ -24,4 +24,7 @@ export interface PlatformUserBySsoId extends Document {
   email: string
 }
 
-export type PlatformUser = PlatformUserByEmail | PlatformUserById | PlatformUserBySsoId
+export type PlatformUser =
+  | PlatformUserByEmail
+  | PlatformUserById
+  | PlatformUserBySsoId
diff --git a/packages/worker/src/api/controllers/global/users.ts b/packages/worker/src/api/controllers/global/users.ts
index 8968ebdcd0..822a16d33e 100644
--- a/packages/worker/src/api/controllers/global/users.ts
+++ b/packages/worker/src/api/controllers/global/users.ts
@@ -95,7 +95,6 @@ const parseBooleanParam = (param: any) => {
 export const adminUser = async (
   ctx: Ctx<CreateAdminUserRequest, CreateAdminUserResponse>
 ) => {
-  // @ts-ignore
   const { email, password, tenantId, ssoId } = ctx.request.body
 
   if (await platform.tenants.exists(tenantId)) {
@@ -137,7 +136,6 @@ export const adminUser = async (
         global: true,
       },
       tenantId,
-      // @ts-ignore
       ssoId,
     }
     try {

From fcb1575da5bec4216d7286e23fe4a9ecbb0056df Mon Sep 17 00:00:00 2001
From: Dean <deanhannigan@gmail.com>
Date: Mon, 25 Sep 2023 10:59:34 +0100
Subject: [PATCH 09/15] Added default config values for buttons on auto screen
 creation. Added behaviour to accomodate screens created without defaults set.

---
 .../src/builderStore/store/screenTemplates/rowListScreen.js     | 2 ++
 packages/client/src/components/app/blocks/TableBlock.svelte     | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/builder/src/builderStore/store/screenTemplates/rowListScreen.js b/packages/builder/src/builderStore/store/screenTemplates/rowListScreen.js
index bbefe65fc8..751f79ef44 100644
--- a/packages/builder/src/builderStore/store/screenTemplates/rowListScreen.js
+++ b/packages/builder/src/builderStore/store/screenTemplates/rowListScreen.js
@@ -33,6 +33,8 @@ const generateTableBlock = datasource => {
       showTitleButton: true,
       titleButtonText: "Create row",
       titleButtonClickBehaviour: "new",
+      sidePanelSaveLabel: "Save",
+      sidePanelDeleteLabel: "Delete"
     })
     .instanceName(`${datasource.label} - Table block`)
   return tableBlock
diff --git a/packages/client/src/components/app/blocks/TableBlock.svelte b/packages/client/src/components/app/blocks/TableBlock.svelte
index 5d8f1b71ae..0ecd8fe98c 100644
--- a/packages/client/src/components/app/blocks/TableBlock.svelte
+++ b/packages/client/src/components/app/blocks/TableBlock.svelte
@@ -249,7 +249,7 @@
             props={{
               dataSource,
               saveButtonLabel: sidePanelSaveLabel || "Save", //always show
-              deleteButtonLabel: deleteLabel, //respect config
+              deleteButtonLabel: deleteLabel == "" ? "" : "Delete",
               actionType: "Update",
               rowId: `{{ ${safe("state")}.${safe(stateKey)} }}`,
               fields: sidePanelFields || normalFields,

From a04dd3a66d1594c14a945bff3f2b7753bed7dd74 Mon Sep 17 00:00:00 2001
From: Dean <deanhannigan@gmail.com>
Date: Mon, 25 Sep 2023 11:40:54 +0100
Subject: [PATCH 10/15] Linting

---
 .../src/builderStore/store/screenTemplates/rowListScreen.js     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/builder/src/builderStore/store/screenTemplates/rowListScreen.js b/packages/builder/src/builderStore/store/screenTemplates/rowListScreen.js
index 751f79ef44..b17bd99e10 100644
--- a/packages/builder/src/builderStore/store/screenTemplates/rowListScreen.js
+++ b/packages/builder/src/builderStore/store/screenTemplates/rowListScreen.js
@@ -34,7 +34,7 @@ const generateTableBlock = datasource => {
       titleButtonText: "Create row",
       titleButtonClickBehaviour: "new",
       sidePanelSaveLabel: "Save",
-      sidePanelDeleteLabel: "Delete"
+      sidePanelDeleteLabel: "Delete",
     })
     .instanceName(`${datasource.label} - Table block`)
   return tableBlock

From d6ae511edac190307be7a2c887bfcee258fd9f7e Mon Sep 17 00:00:00 2001
From: Dean <deanhannigan@gmail.com>
Date: Mon, 25 Sep 2023 12:43:43 +0100
Subject: [PATCH 11/15] Refactor of the delete label logic into a block

---
 .../components/app/blocks/TableBlock.svelte   | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/packages/client/src/components/app/blocks/TableBlock.svelte b/packages/client/src/components/app/blocks/TableBlock.svelte
index 0ecd8fe98c..1cb77cb3e5 100644
--- a/packages/client/src/components/app/blocks/TableBlock.svelte
+++ b/packages/client/src/components/app/blocks/TableBlock.svelte
@@ -45,8 +45,21 @@
   let enrichedSearchColumns
   let schemaLoaded = false
 
-  // Accommodate old config to ensure delete button does not reappear
-  $: deleteLabel = sidePanelShowDelete === false ? "" : sidePanelDeleteLabel
+  $: deleteLabel = setDeleteLabel(sidePanelDeleteLabel, sidePanelShowDelete)
+
+  const setDeleteLabel = sidePanelDeleteLabel => {
+    // Accommodate old config to ensure delete button does not reappear
+    let labelText = sidePanelShowDelete === false ? "" : sidePanelDeleteLabel
+
+    // Empty text is considered hidden.
+    if (labelText?.trim() === "") {
+      return ""
+    }
+
+    // Default to "Delete" if the value is unset
+    return labelText || "Delete"
+  }
+
   $: isDSPlus = dataSource?.type === "table" || dataSource?.type === "viewV2"
   $: fetchSchema(dataSource)
   $: enrichSearchColumns(searchColumns, schema).then(
@@ -249,7 +262,7 @@
             props={{
               dataSource,
               saveButtonLabel: sidePanelSaveLabel || "Save", //always show
-              deleteButtonLabel: deleteLabel == "" ? "" : "Delete",
+              deleteButtonLabel: deleteLabel,
               actionType: "Update",
               rowId: `{{ ${safe("state")}.${safe(stateKey)} }}`,
               fields: sidePanelFields || normalFields,

From 83f042eeaf67aac1d13f3a8d29b1c6332dacc624 Mon Sep 17 00:00:00 2001
From: Martin McKeaveney <martinmckeaveney@gmail.com>
Date: Mon, 25 Sep 2023 13:57:10 +0100
Subject: [PATCH 12/15] update name of platform users view so it rebuilds

---
 packages/backend-core/src/constants/db.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/backend-core/src/constants/db.ts b/packages/backend-core/src/constants/db.ts
index 83f8298f54..f918dcc352 100644
--- a/packages/backend-core/src/constants/db.ts
+++ b/packages/backend-core/src/constants/db.ts
@@ -18,7 +18,7 @@ export enum ViewName {
   ROUTING = "screen_routes",
   AUTOMATION_LOGS = "automation_logs",
   ACCOUNT_BY_EMAIL = "account_by_email",
-  PLATFORM_USERS_LOWERCASE = "platform_users_lowercase",
+  PLATFORM_USERS_LOWERCASE = "platform_users_lowercase_2",
   USER_BY_GROUP = "user_by_group",
   APP_BACKUP_BY_TRIGGER = "by_trigger",
 }

From 91e488f8192f9239a09fe5a879081e1262735be5 Mon Sep 17 00:00:00 2001
From: Budibase Staging Release Bot <>
Date: Mon, 25 Sep 2023 12:59:24 +0000
Subject: [PATCH 13/15] Bump version to 2.10.13

---
 lerna.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lerna.json b/lerna.json
index 19298d35ec..6b5509ed5c 100644
--- a/lerna.json
+++ b/lerna.json
@@ -1,5 +1,5 @@
 {
-  "version": "2.10.12",
+  "version": "2.10.13",
   "npmClient": "yarn",
   "packages": [
     "packages/*"

From d8c051efbe4f1c00076db38316308bd02cca0b52 Mon Sep 17 00:00:00 2001
From: Budibase Staging Release Bot <>
Date: Mon, 25 Sep 2023 16:55:17 +0000
Subject: [PATCH 14/15] Bump version to 2.10.14

---
 lerna.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lerna.json b/lerna.json
index 6b5509ed5c..0c9e739afc 100644
--- a/lerna.json
+++ b/lerna.json
@@ -1,5 +1,5 @@
 {
-  "version": "2.10.13",
+  "version": "2.10.14",
   "npmClient": "yarn",
   "packages": [
     "packages/*"

From f17ac2c98bb56aac80f1f4605155066b263ae4c4 Mon Sep 17 00:00:00 2001
From: Budibase Staging Release Bot <>
Date: Mon, 25 Sep 2023 18:48:12 +0000
Subject: [PATCH 15/15] Bump version to 2.10.15

---
 lerna.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lerna.json b/lerna.json
index 0c9e739afc..b3eeaad3f5 100644
--- a/lerna.json
+++ b/lerna.json
@@ -1,5 +1,5 @@
 {
-  "version": "2.10.14",
+  "version": "2.10.15",
   "npmClient": "yarn",
   "packages": [
     "packages/*"